Cloud

Not in scope (for FY23 / FY24):

• supporting customer provided GCP infrastructure
• supporting cloud providers other than GCP
• managing Sourcegraph installations in clusters not provisioned by the Cloud team (Bring-your-own-Kubernetes)
• supporting customers smaller than X1 ARR
• optimizing cost below X2 $/month

Q3FY23 goals

• Support the initiative to make the Cloud a preferred deployment method from the platform and infrastructure perspective
• Cloud v2 - migrate current the Cloud (managed instances) from single-VM, Docker Compose based architecture to multi-node, GKE based architecture

Workflow

1. CE seeks Managed Instance approval from their regional CE Manager
2. The Regional CE Manager will review the following criteria:
   • Overall, is the deal qualified?
   • Is it technically qualified? We have documented POC success criteria and the customer agrees to the criteria. We have documented the basic technical requirements of the customer (languages, repo types, security, etc.)
   • If anything is non-standard, it must pass the tech review process
3. If approved, then CE proceeds based on whether this is a standard or non-standard managed instance scenario:
   • For standard managed instance requests (i.e., new instance, no scale concerns, no additional security requirements), CE submits a request to the Cloud team using the corresponding issue template in the sourcegraph/customer repo.
   • For non-standard managed instance requests (i.e., any migrations, special scale or security requirements, or anything considered unusual), CE submits the opportunity to Tech Review before making a request to the Cloud team.
4. Message the team in #cloud.
5. If denied, the CE/AE can appeal through the CE/AE leadership chain of command.

Cloud launch process

Issue tracking

The Cloud team GitHub Project is the single source of truth.

How we use GitHub Projects (Beta)

Grooming and Estimation process

On-call

We maintain an on-call rotation in Opsgenie. Responsibilities of the teammate who is on-call include:

• Acknowledging incoming alerts
• Initiating incident procedures
• Publishing postmortems

FAQ: Can customers disable the “Builtin username-password authentication”?

Yes, you may disable the builtin authentication provider and only allow creation of accounts from configured SSO providers.

However, in order to preserve site admin access for Sourcegraph operators, we need to add Sourcegraph’s internal Okta as an authentication provider. Please reach out to our team prior to disabling the builtin provider.

FAQ: How do I restart the frontend after changing the site-config?

Are you a member of our CE & CS teams?

• Visit sourcegraph/deploy-sourcegraph-managed
• Locate the slug of the customer instance from list of folders
• Visit https://github.com/sourcegraph/deploy-sourcegraph-managed/actions/workflows/reload_frontend.yml
• Click Run workflow and input the slug of customer instance
• Click the Run workflow green button
• Done! It shouldn’t take more than 2 minutes

FAQ: What are Cloud plans for observability - can I see data from customer instances in Honeycomb / Grafana Cloud / X?

Cloud instances provisioned for customers provide the same monitoring data / tooling as all other Sourcegraph instances (Grafana/Prometheus for metrics, Jaeger for traces). GCP Logging is used to store / query logs written by Sourcegraph workloads, and GCP Monitoring is used for infrastructure-level metrics / uptime checks.

Access to data from Cloud instances is governed by Cloud Access Control Policy.

Long-term, we will collaborate with DevX team (as owners of Sourcegraph observability) to support monitoring / observability solutions that are qualified for use with customer data.

FAQ: What are Cloud plans for continuous deployment - how often do we deploy code to Cloud instances?

Cloud instances provisioned for customers run released Sourcegraph versions and are currently updated at least once a month (for minor releases), unless we need to deploy a patch release.

Sourcegraph-owned instances are continuously deployed (with versions that weren’t officially released), DevX team owns continuous deployment to those environments.

FAQ: What are Cloud plans for analytics - where can I see data from Cloud instances in Looker / Amplitude?

Cloud instances do not expose analytics data other than pings. Future work in this area is owned by Analytics team and managed through the “Improve our data collection” cross-functional project.

FAQ: Does Cloud support data migrations?

Cloud instances are created without any customer data (repos / code-host connections / code / user accounts / code insights etc.), and Cloud team does not support importing customer data from self-managed / jointly-managed / Cloud-managed Sourcegraph instances.

FAQ: How to use mg cli for Managed Instances operations?

git clone https://github.com/sourcegraph/deploy-sourcegraph-managed
cd deploy-sourcegraph-managed
echo "export MG_DEPLOY_SOURCEGRAPH_MANAGED_PATH=$(pwd)" >> ~/.bashrc
mkdir -p ~/.bin
export GOBIN=$HOME/.bin
echo "export PATH=\$HOME/.bin:\$PATH" >> ~/.bashrc
source ~/.bashrc
make install
mg --help

FAQ: How do I generate a password reset link for customer admin?

For #cloud engineers, run mg reset-customer-password -email <> and it will generate a 1password share link for you.

The password reset link expires after 24h, so it’s quite common that CE would have to generate a new link during the initial hand-off process.

If access to the instance is restricted, either via VPN or CIDR whitelist, please reach out to #cloud for assistance.

Otherwise, the CE responsible for the customer is added as site-admin, so CE can login with “Sourcegraph Employee” (Google Workspace) auth provider and reset customer admin password. Otherwise, please reach out to #cloud for assistance.

IMPORTANT: Please do not share the password reset url directly with the customer admin over email or slack. More context.

Open 1password, and create a new Secure Note item and paste the password reset url, then use the 1password share item feature to securely share the link with customer admin. Make sure you configure the following options while sharing the item:

• Link expires after: 1 day
• Available to: <insert customer admin email>

This ensures only the customer admin is able to gain access to the password reset url.

FAQ: I have a new feature I want to deploy to Cloud, how do I do that?

Read through our Cloud Cost Policy

FAQ: What are Cloud plans for analytics - where can I see data from Cloud instances in Looker / Amplitude?

Cloud instances do not expose analytics data other than pings. Future work in this area is owned by Analytics team and managed through the “Improve our data collection” cross-functional project.

FAQ: How to list trial, production or internal instances?

You can either use:

• Github Action (ce email parameter is optional).
• mg cli via command:

mg info --ce <NAME>@sourcegraph.com --instance-type [trial|production|internal] (both parameters are optional)